Pennsylvania crypto regulation and the gap Act 7 left open

Pennsylvanians filed 5,118 crypto crime complaints with the FBI’s Internet Crime Complaints Center (IC3) in 2025 and reported $292.9M in losses, fifth in the country by complaints and eighth* by losses. The average loss was $57,228, ranking it 24th. Pennsylvania is targeted frequently, and for a large collective total, by cases that are, on average, mid-sized. 

The more important number is that crypto now accounts for 54.5% of everything Pennsylvanians report losing to cybercrime, one of 31 states where the crypto share has passed half. It has stopped being a category of internet crime and now constitutes a clear majority of reported internet crime. 

Federal capacity in the Commonwealth is limited to two FBI field offices and three US Attorneys’ offices compared to those numbers. This means that most of the caseload will fall to state, municipal and county agencies, and the capability it demands, such as tracing a Tether transfer across Tron, must sit with the case officer, not in a single specialist unit. 

Crystal set out to unpack Pennsylvania’s crypto losses and what to do about them. 

Key takeaways 

• The FBI’s 2025 Internet Crime Report records 5,118 crypto complaints and $292,893,338 in losses in Pennsylvania, placing it fifth by count and eighth* by losses, respectively. The 2025 average loss of $57,228 ranked the state 24th: fifth in volume, 24th in value. Local agencies carry the investigative burden. 

• Licensing is live, and there was no grace period. Act 7 of 2025 settled it, bringing virtual currency transmission under the Money Transmitter Act in June 2025, with the law taking effect on August 26, 2025. The Department of Banking and Securities confirmed there would be “no grace period for licensure” from that date, and compliance teams at businesses wishing to access Pennsylvania’s virtual asset economy will have to act now. 

• Crypto kiosks, of which CoinATM Radar estimates there are close to 1,000 in Pennsylvania, are covered by money transmitter licensing but face no kiosk-specific rules. Senate Bill 1015 and House Bill 2643 would bring operators under the Department’s licensing and require them to comply with tighter anti-ATM fraud measures. 

• Losses are concentrated among older residents: State-specific crypto crime analysis recorded 4,240 victims and $244.4M lost in 2025. Victims 60 and over accounted for 35% of complainants and 53% of dollars lost, at 2.11 times the under-60 average loss. This is a strong indicator to law enforcement agencies of which demographic is the most vulnerable to this crime category. 

• Twenty-five of Philadelphia’s thirty-nine cash desks also advertise in Russia. One operator holding both ends settles internally, so law enforcement agents should trace the operator rather than the chain. 

How large is Pennsylvania, and why does its age profile matter? 

The Commonwealth of Pennsylvania’s estimated population of 13.06 million (July 2025) makes it the fifth most populous US state, and its 2025 nominal GDP of $1.056Tn makes it the sixth-largest state economy. It is also one of the oldest, with 21.4% of residents aged 65 or over, again emphasizing to law enforcement agencies where risk lies.

Source: Crystal Intelligence. 

How does Pennsylvania crypto regulation work under Act 7? 

Pennsylvania regulates virtual currency through the Department of Banking and Securities under the Money Transmitter Act, as amended by Act 7 of 2025. Getting there took six years, a reversal, and an act of the legislature.

In January 2019, the Department concluded that virtual currency was not “money” under the Act and that exchanges and kiosk operators needed no license. In April 2024, it published a statement of policy reversing that reading, effective October 15, 2024. The legislature then settled the question in statute. 

Senate Bill 202, signed by Governor Josh Shapiro on June 27, 2025, became Act 7 and took effect 60 days later. It requires any person who transmits virtual currency for a fee to hold a Department license, modernizes the Act’s definitions and exemptions, and makes Pennsylvania one of roughly 27 states regulating virtual currency in this way. The 2024 policy statement was rescinded the same day. 

Department Secretary Wendy Spicher was direct in announcing it: before Act 7, a company transmitting money for a fee needed a license, but one transmitting Bitcoin did not, and “that gap left consumers unprotected.” Applications are filed through the Nationwide Multistate Licensing System (NMLS), and unlicensed operators serving Pennsylvania residents have been in breach since August 2025. 

What gap did Act 7 leave open for crypto kiosks? 

Act 7 regulates transmission. It creates no kiosk-specific regime, and the kiosk is where the documented harm concentrates. Two bills target that channel: 

• Senate Bill 1015, sponsored by Senator Tracy Pennycuick, would require kiosk operators to hold money transmitter licenses, display anti-fraud warnings, and staff a 24-hour support line. 

• House Bill 2643, introduced on June 18, 2026, by Representatives Joe Ciresi and Liz Hanbidge, goes further: licensing, daily transaction and fee caps, identity verification, itemized receipts, a 72-hour cancellation window for new users, and refunds where a victim reports to law enforcement within 60 days. 

Senior deputy attorney general Paul Edger told senators at April 2026 hearings that operators “know scams are occurring at dangerously high numbers and provide only minimal warnings.” 

This echoed law enforcement sentiment on the ground, with the Manheim Township Police Department warning the public in June 2025 about a government official impersonation scam centered on crypto kiosks. The American Association of Retired Persons (AARP) further cautioned older Pennsylvanians about the fraud risks associated with crypto kiosks in February 2026, with Detective Kyle Smith adding that officers received such reports almost weekly. 

What crypto trading infrastructure can Pennsylvanians use? 

Pennsylvania never built a bespoke virtual currency license. Act 7 works through the existing Money Transmitter Act, so the Commonwealth has no exclusion mechanism comparable to New York’s BitLicense, under which Kraken discontinued service to New Yorkers, and Binance.US declined to enter. 

Major US exchanges. The large retail platforms hold Pennsylvania money transmitter licenses rather than a crypto-specific authorization. Coinbase discloses a Pennsylvania Money Transmitter license 51015, issued by the Department of Banking and Securities. Licensure, not availability, is now the operative question in Pennsylvania, and the register that answers it is the NMLS Consumer Access. 

Peer-to-peer marketplaces. Bisq is decentralized and non-custodial, which places it outside the licensing trigger under Act 7. LocalCoinSwap and RoboSats accept US residents. The statutory test is intermediation: an operator that can execute or block a transfer needs a license, regardless of what it calls itself.

Above: Chart showing that Bisq’s ceiling sits inside the kiosk caps Pennsylvania is debating. Neither reaches the cash desks, so the legislature’s bill addresses retail rather than the high-value channel. Source: Crystal Intelligence.

Over-the-counter desks. Coinbase Prime, Kraken OTC, Gemini eOTC, Galaxy Digital, and Cumberland (DRW) all serve institutional clients that may include Pennsylvania entities; their underlying US regulatory status varies – state money transmitter licenses, FinCEN MSB registration, and (for Coinbase/Gemini) New York State trust charters – with no evidence of a uniform licensing basis across all five. 

Crypto kiosks. As of September 7, 2026: 

• CoinATM Radar estimated that there were 989 crypto kiosks in Pennsylvania. Operator directories are the only public source. 

• CoinFlip lists 155 Pennsylvania locations across 114 cities and towns, 

• Byte Federal lists 38, and  

• Bitcoin Depot reported 462 at April’s Senate hearing. 

Those three operators accounted for 655 machines as of this writing. 

Banking and custody. Pennsylvania has no analog to New York’s NYDFS-chartered trust companies. Its most consequential digital asset institution is an ordinary commercial bank. Customers Bank of Malvern processed $1.5Tn in digital asset transaction volume in 2024 through its cubiX instant payments system and operates under an August 2024 Federal Reserve order requiring advance approval before it adds digital asset partnerships or services. 

How much do Pennsylvania crypto crime losses total? 

In 2025, the IC3 recorded 5,118 complaints and $292,893,338 in losses in Pennsylvania, ranking the state fifth in the country by reported crypto-linked losses, and eighth* by dollar value.

Source: Crystal Intelligence. 

Kiosk harm is separately measurable. The IC3’s May 2026 public service announcement on kiosk complaints records 518 Pennsylvania complaints and $14,485,236 in adjusted losses. Respectively, Pennsylvania ranked fourth by complaint count and eighth by adjusted losses, like its overall rankings for crypto crime. 

What should Pennsylvania law enforcement and regulators focus on? 

Build blockchain investigative capability at the case officer level. Pennsylvania’s two FBI field offices at Philadelphia and Pittsburgh, and three US Attorneys’ offices cannot alone handle 5,118 crypto complaints a year, averaging over $57,000 each. This means that investigating crypto crimes and performing on- and off-chain tracking and tracing must fall to the Commonwealth’s estimated 1,200 municipal, regional, and county detective agencies. 

Most of the departments that will take the next report have never traced a Tron transaction. The constraint is not legal authority but rather whether a county detective can trace funds across chains and produce court-admissible attribution. This means specialized training must become integral to combating the growing threat of crypto crime losses for Philadelphians, and additional reporting resources for crypto fraud should be made available to the public to further support law enforcement agencies at every level of government in the state. 

What does Crystal’s data show above Pennsylvania’s crypto kiosk caps? 

Crystal monitors BestChange, a cash-for-crypto aggregator popular with Russian speakers, across 522 cities worldwide. Pennsylvania appears in that footprint exactly once. As of September 16, 2026, Philadelphia carries 1,297 cash-handling listings from 38 distinct exchange services, and 1,316 advertised listings from 39 services. No other city in the Commonwealth is listed, Pittsburgh and Harrisburg (the State Capital) included.

The market runs one way. Thirty-nine operators advertise paying out US dollar cash (USD), across 769 listings. Twenty-three accept it, across 497. That asymmetry is what separates a cash-out conduit from a bureau de change, and it describes the terminal step in most crypto laundering typologies: the point at which value leaves the traceable ledger.

Above: Bar chart showing that cash leaves the chain more often than it enters. For Pennsylvania investigators, Philadelphia is a cash-out point, the terminal laundering step, not a funding channel. Source: Crystal Intelligence monitoring of BestChange, as of September 16, 2026. 

Ticket sizes exclude retail by design. Not one cash-in listing accepts below $9,924, and the median minimum is exactly $10,000. Converted at each operator’s quoted rate, cash-out minimums range from $8,970 to $10,000. Senate Bill 1015 and House Bill 2643 would cap daily kiosk transactions, and Florida set its own caps at $2,000 for new customers and $10,000 for existing ones. Whatever figure Pennsylvania settles on, this channel begins above it. 

Privacy-asset coverage is wider here than in New York on every measure. Monero is advertised against USD by 29 of Philadelphia’s 39 operators, compared with 74% in New York’s 59. Dash reaches 56% against 37%, Zcash 44% against 29%. The implied Monero spread is 12.4%, calculated after excluding two operators quoting roughly a third away from consensus in one direction only, which indicates a stale price feed rather than an arbitrage.

Above: Chart showing that Philadelphia’s smaller market offers more privacy-coin cover than New York’s larger one, which has grown since the publication of our New York report. Pennsylvania investigators face thinner on-chain trails than the raw volume of desks suggests. Source: Crystal Intelligence. 

The apparent choice is narrower than 39. Ten operators advertise an identical $450,000 ceiling, the same figure that recurs across New York desks. Three more quote Zcash at 434.7798 to four decimal places, and two quote Monero at 479.5979. Independent businesses do not converge like that. A shared pricing feed, a white-label platform or common ownership would each explain it, and this data cannot distinguish between them. 

Nor is the footprint local. Twenty-five of the 39 also advertise desks in Russian cities and 20 in Crimea or occupied eastern Ukraine (both in Eastern Europe). Thirty-four advertise in Northern Cyprus, 20 in Transnistria (an unrecognized breakaway state that is legally part of Moldova, Eastern Europe) and three at the Armenia to Iran land border, though none in Iran itself. Together, they reach 452 of the 522 cities monitored. An operator holding desks at both ends can settle internally, netting a Philadelphia deposit against a Rostov payout across its own books with crypto as the intermediate leg, and neither side needs ever to appear as a linked transaction on any chain.

Above: Chart showing that, for Pennsylvania detectives, two-thirds of Philadelphia desks can settle a deposit against a Russian payout internally, leaving no linked transaction visible on any chain. Source: Crystal Intelligence. Source: Crystal Intelligence. 

Two things are absent. No operator advertises cash for cash in Philadelphia, so every product here still has a blockchain leg, which is the one favorable finding for investigators. And Crystal’s vault holds no cash-services register entry for Pennsylvania at all. 

The channel is also growing. The number of operators advertising privacy assets rose from 22 in mid-August to 27 by September 16. MChanger first appeared on August 27 and is now the joint second-largest desk in the city. 

All figures are self-reported aggregator listings, current as of September 16, 2026. A listing evidences an advertised service, not an office, a license, or any completed transaction. 

Frequently asked questions 

• Does Pennsylvania require a license to run a crypto exchange or kiosk? 

Yes, for virtual currency transmission. Act 7 of 2025 requires anyone transmitting virtual currency for a fee to hold a Money Transmitter Act license from the Department of Banking and Securities, effective August 26, 2025, with no grace period. Kiosk-specific conditions are the subject of pending legislation. 

• What federal deadlines apply to Pennsylvania licensees?

The GENIUS Act required final federal stablecoin rules to be issued by July 18, 2026, affecting any Pennsylvania money transmitter that issues or handles stablecoins. The CLARITY Act, which would centralize federal market-structure authority while preserving state anti-fraud authority, was blocked by the Senate on September 15, 2026. 

• Would capping crypto kiosk transactions stop Pennsylvania’s losses? 

Not entirely. Crystal’s monitoring found Philadelphia cash-for-crypto desks that refuse transactions below $10,000, above the caps Florida set. Kiosk caps address the retail channel where most complaints originate, but a higher-value channel already operates above any cap the legislature is likely to choose. 

• Will Senate Bill 1015’s kiosk caps reach the cash-for-crypto market? 

The kiosk caps would not reach it. No Philadelphia cash desk accepts below $9,924, and the median minimum is $10,000. Kiosks and cash desks serve different customers at different sizes, so a daily cap on one leaves the other untouched. 

• Who loses money to crypto fraud in Pennsylvania? 

According to state-level data, older residents are disproportionately affected. Of the 4,240 victims whose ages IC3 recorded in 2025, those over 60 filed 35% of complaints but lost 53% of the money, averaging $87,500 each, compared with $41,564 for younger victims. Investment fraud accounts for most of it. 

• Does the use of privacy coin in Philadelphia mean the trail is dead? 

Privacy coins narrow the trail without ending it. Monero is advertised by 29 of Philadelphia’s 39 cash services, with wider coverage than in New York. But no operator trades cash for cash, so every product still has a blockchain leg to follow. 

In conclusion, what does all of this mean for Pennsylvania crypto regulation in 2026? 

Pennsylvania is not a permissive jurisdiction, and it is no longer ambiguous. Act 7 settled the licensing question, and the Department now supervises a market it had no authority over two years ago. But the harm in the 2025 data ran through a channel the statute does not address, to a demographic the state has in unusual proportion. 

That makes the next 12 months a capability question rather than a legislative one. State law enforcement needs blockchain forensics capabilities at the case officer level, and newly licensed transmitters need compliance controls that match what an examiner will ask for.

*IC3 also publishes annual state-by-state analyses, on which Pennsylvania ranked seventh in losses during 2025, according to the writer’s calculations. The disparity arises from Oregon, whose printed crypto losses exceed its total losses from all internet crime, placing it fifth, pushing Pennsylvania to eighth. 

Crystal raised this with the FBI’s Portland field office. The National Press Office responded, explaining that IC3 statistics are a point-in-time assessment that may change “based upon investigative or analytical proceedings,” as Appendix C sets out, and that current data align more closely with the figure in the annual report. 

Crystal thanks the FBI for the clarification. This article follows the annual report, and Crystal will continue to consult IC3 data as the US state-by-state series develops.